Hello, I mapped the backend roles from LDAP. There are some users who have multiple backend roles. Those users are only able to see logs from the role which have least permission. For example a user is mapped to all_access and another role (ABCD for example). The user lost access for (all_access) r…

@kanath can you provide definition for this ABCD role. Also, please confirm what version of odfe you are running. I just tested locally with 1.13.1, mapped user to all_access and test_role with only access to 1 index, and was able to create new index not listed in test_role. Is there any DLS filte…

Hello, I am using 1.12.0 There is a DLS filter for ABCD role for example: {“bool”:{“must”:[{“term”:{“somefield”:“somevalue”}}]}} The user is only able to see the documents which matches “somefield”:“somevalue”

@kanath The DLS is the issue here, the way it seems to work is if a user has a role that defines DLS restrictions on an index and another role has no DLS restrictions on the same index, the restrictions defined in the first role apply. Currently there doesn’t seem to be a way to change this behaviou…

Okay. Is there any workaround that can be applied for this issue except removing ABCD role from the user?

Users getting least permissions when mapped to multiple roles

Security

rlevitsky December 28, 2023, 3:22pm 6

I have the same issue.

Adding role to user breaks his access

Topic		Replies	Views
How is DLS applied when user has multiple roles Security	6	1301	February 2, 2024
Adding role to user breaks his access Security	2	353	February 5, 2024
DLS and LDAP Backend Roles _opendistro_security_dls_query does not match (SG 900D) Security troubleshoot	4	614	July 4, 2022
LDAP backend group - Opensearch role permissions issue Security troubleshoot	9	851	May 19, 2023
Ldap users assigned to roles and index security error Security	3	501	January 15, 2021

Users getting least permissions when mapped to multiple roles

Related topics